Bypass UAC Using Event Viewer Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•30

This rule detects attempts to bypass User Account Control (UAC) by modifying the Windows Registry related to the 'mscfile' handler. Specifically, it looks for changes to the default command associated with '.msc' files, which can be abused by 'eventvwr.exe' to execute arbitrary code with elevated privileges without a UAC prompt. The filter excludes legitimate modifications where the 'Details' field starts with '%SystemRoot%\system32\mmc.exe "%1" %', aiming to reduce false positives from standard system operations.